Authentication implementation
Unanswered
Toy Manchester Terrier posted this in #help-forum
Toy Manchester TerrierOP
Hey everyone,
I have an unusual case of authentication, so looking if any experts here could give some advice.
I have a website which is protected with auth0. And API which is protected by auth0 jwt. Now the fun part is I also have a VR app in which the authentication is used. And I want users to access parts of website inside of VR app without having to reauthenticate in vr's in-app browser.
I am currently rewriting the code for my site with app router and next-auth with auth0, where as previous implentation used SPA auth0. Earlier I used to set JWT from vr's app in cookies and extract and use in getInitialProps.
Now I am wondering what is right way to do it, I want to avoid doing server side rendering for user's page, but if jwt has to be encrypted should I use backend only to call my external api?
If someone has thoughts on it, would love to hear some.
I have an unusual case of authentication, so looking if any experts here could give some advice.
I have a website which is protected with auth0. And API which is protected by auth0 jwt. Now the fun part is I also have a VR app in which the authentication is used. And I want users to access parts of website inside of VR app without having to reauthenticate in vr's in-app browser.
I am currently rewriting the code for my site with app router and next-auth with auth0, where as previous implentation used SPA auth0. Earlier I used to set JWT from vr's app in cookies and extract and use in getInitialProps.
Now I am wondering what is right way to do it, I want to avoid doing server side rendering for user's page, but if jwt has to be encrypted should I use backend only to call my external api?
If someone has thoughts on it, would love to hear some.
6 Replies
Now I am wondering what is right way to do it, I want to avoid doing server side rendering for user's page, but if jwt has to be encrypted should I use backend only to call my external api?
In App router, If you don't mind about turning the page into SSR, you can do the same with
cookies function. Decrypt the JWT cookie in a server component and pass it via Context.I don't know what does "external API" refer to. Assume JWT cookie is stored under a different domain than your external API, surely a proxy backend is your way to go. The backend receives JWT token and make API calls to the external API, which is necessary if the external service doesn't support client-side authentication
Toy Manchester TerrierOP
@fuma Thanks for responding.
By external api, I meant my own api, which is hosted separately, out of nextjs.
I don't mind using SSR, if it's working good enough for user's pages.
What I am wondering is how do I pass it through the VR app?
By external api, I meant my own api, which is hosted separately, out of nextjs.
I don't mind using SSR, if it's working good enough for user's pages.
What I am wondering is how do I pass it through the VR app?
if I'm right, you're trying to authenticate the user from an in-app browser, which as far as I know, you can't set cookies of the in-app browser from the app
Is user logged into the VR app? You can actually pass your JWT token via query parameter, so that from middleware, you can receive the JWT token and identify them as authenticated
Is user logged into the VR app? You can actually pass your JWT token via query parameter, so that from middleware, you can receive the JWT token and identify them as authenticated
Then just redirect users to to your website with
?jwt_token=xxx insteadToy Manchester TerrierOP
Yes, I am using in-app browser and this one allows you to set the cookies.
If you can set a cookie, you can read the cookie in a middleware (read the docs for further info)
However, in some cases, you would like to do some database queries for verifying users, then you can achieve it with
However, in some cases, you would like to do some database queries for verifying users, then you can achieve it with
cookies function in a page/layout